Skip to content
Leak-site post naming Buchanan Ingersoll & Rooney PC, captured by ThreatCluster
Back to victims

Buchanan Ingersoll & Rooney PC

falcon

Ransomware leak-site victim intelligence

Data size
182 GB compressed · 260 GB uncompressed
Posted
Nov 3, 2026
Country
US
Industry
Full-service law firm

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Falcon claims 260 GB uncompressed of data was exfiltrated from Buchanan Ingersoll & Rooney PC, including a full DynamicCRM export with accounts, contacts and campaign data. The leak describes the data set as including privileged attorney-client communications, NDAs with clients, internal board and shareholder materials, firm financial projections, client revenue lists, tax returns, credential and identity directory exports, and regulatory correspondence with the FDA and DOJ, among other items. The leak post is published and identifies the victim as Buchanan Ingersoll & Rooney PC, a full-service law firm, with DynamicCRM named as the platform.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
DynamicCRM

What was taken

Full-service law firm

Data categories
privileged attorney-client communicationsexecuted NDAs with clientsinternal board presentationsshareholder meeting materialsfirm financial projectionsattorney rate sheetsdetailed client revenue listscredential and identity directory exportstax returnsinternal personnel alertsregulatory correspondence with FDA and DOJcost and damages analysesstrategic settlement communicationsexecuted M&A documents
Sample files (1)
Buchanan.7z

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture